TechSnif — Tech News Intelligence CLI

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:46 AM UTC
• Version: 1.0.4

Overview

This skill appears to be a read-only tech-news tool, but it needs review because its bundled CLI can be redirected to arbitrary web endpoints instead of only TechSnif.

Install only if you are comfortable with the skill making live network requests for tech-news queries. Avoid using --api-url or TECHSNIF_API_URL unless you intentionally trust the alternate endpoint, because that endpoint can receive your query terms and supply content the agent may summarize.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/techsnif-cli.cjs:3556

Finding

Arbitrary and Insecure API Endpoint Override

Content

View full analysis

", "Override the TechSnif API base URL", getDefaultApiUrl()); return command; } ``` ### Technical Analysis The CLI permits the API base URL to be replaced through either the `TECHSNIF_API_URL` environment variable or the `--api-url` command-line option. Validation only checks whether the scheme is HTTP or HTTPS; it does not restrict the destination host, reject private or loopback addresses, or require encrypted transport. Consequently, an attacker who can influence the execution environment or generated CLI arguments can redirect requests to: - An attacker-controlled server that returns forged article data. - A plaintext HTTP endpoint vulnerable to interception and response modification. - Internal, loopback, or link-local ...[truncated 2328 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md

node scripts/techsnif-cli.cjs trending --json

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md

node scripts/techsnif-cli.cjs trending --json

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

node scripts/techsnif-cli.cjs trending --json

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md

node scripts/techsnif-cli.cjs trending --json

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md

node scripts/techsnif-cli.cjs trending --json

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md

node scripts/techsnif-cli.cjs trending --json

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md

node scripts/techsnif-cli.cjs trending --json

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md

node scripts/techsnif-cli.cjs trending --json

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md

node scripts/techsnif-cli.cjs trending --json

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

md

node scripts/techsnif-cli.cjs trending --json

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · scripts/techsnif-cli.cjs (reported line 2633)May include surrounding context.

js

* Parse options from `argv` removing known options,
       * and return argv split into operands and unknown arguments.
       *
       * Side effects: modifies command by storing options. Does not reset state if called again.
       *
       * Examples:
       *

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill explicitly instructs the agent to run a bundled CLI that reaches a remote API, yet it declares no tool scope or permission boundary for network and environment access. This creates an authorization gap where the agent may invoke code with broader capabilities than the skill metadata communicates, reducing reviewability and increasing the chance of unintended data access or outbound requests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger description contains very broad, common phrases such as 'AI news', 'tech news', and 'any news about [company/topic]', which can cause the skill to activate in many loosely related conversations. Because the skill then directs the agent to execute a networked CLI, accidental invocation can lead to unnecessary external requests and unintended handling of user-provided query text.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/techsnif-cli.cjs (reported line 320)May include surrounding context.

js

*/
      subcommandTerm(cmd) {
        const args = cmd.registeredArguments.map((arg) => humanReadableArgName(arg)).join(" ");
        return cmd._name + (cmd._aliases[0] ? "|" + cmd._aliases[0] : "") + (cmd.options.length ? " [options]" : "") + // simplistic check for non-help option
        (args ? " " + args : "");
      }
      /**

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The CLI sends HTTP requests in fetchJson() and several commands invoke it, but the code provides no confirmation prompt or user-facing notice at the point of transmission. Because this is a code file and the operation transmits user-supplied query parameters and environment-selected endpoint data, it should include some visible disclosure unless covered elsewhere.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/techsnif-cli.cjs:1819

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/techsnif-cli.cjs:3556